rust-oxide-realtime 0.2.0

Reusable realtime transport primitives for Axum servers and Rust websocket clients
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

use super::{ChannelName, ConnectionMeta, RealtimeError};

pub trait ChannelPolicy: Send + Sync {
    fn can_join(&self, meta: &ConnectionMeta, channel: &ChannelName) -> Result<(), RealtimeError>;
    fn can_publish(
        &self,
        meta: &ConnectionMeta,
        channel: &ChannelName,
        event: &str,
    ) -> Result<(), RealtimeError>;
}

#[derive(Debug, Default)]
pub struct DefaultChannelPolicy;

impl ChannelPolicy for DefaultChannelPolicy {
    fn can_join(&self, meta: &ConnectionMeta, channel: &ChannelName) -> Result<(), RealtimeError> {
        let name = channel.as_str();
        if let Some(user) = name.strip_prefix("user:") {
            if user == meta.user_id || is_admin(meta) {
                return Ok(());
            }
            return Err(RealtimeError::forbidden(
                "Cannot join another user's private channel",
            ));
        }
        if name.starts_with("admin:") && !is_admin(meta) {
            return Err(RealtimeError::forbidden(
                "Admin channel requires admin role",
            ));
        }
        Ok(())
    }

    fn can_publish(
        &self,
        meta: &ConnectionMeta,
        channel: &ChannelName,
        event: &str,
    ) -> Result<(), RealtimeError> {
        if event.trim().is_empty() {
            return Err(RealtimeError::bad_request("Event name is required"));
        }
        let name = channel.as_str();
        if let Some(user) = name.strip_prefix("user:") {
            if user == meta.user_id || is_admin(meta) {
                return Ok(());
            }
            return Err(RealtimeError::forbidden(
                "Cannot publish to another user's private channel",
            ));
        }
        if name.starts_with("admin:") && !is_admin(meta) {
            return Err(RealtimeError::forbidden(
                "Admin channel requires admin role",
            ));
        }
        Ok(())
    }
}

fn is_admin(meta: &ConnectionMeta) -> bool {
    meta.roles.iter().any(|role| role == "admin")
}

#[cfg(test)]
mod tests {
    use uuid::Uuid;

    use super::*;
    use crate::server::ConnectionId;

    fn connection_meta(user_id: &str, roles: Vec<String>) -> ConnectionMeta {
        ConnectionMeta {
            id: ConnectionId(Uuid::new_v4()),
            user_id: user_id.to_string(),
            roles,
            joined_at_unix: 0,
        }
    }

    #[test]
    fn user_cannot_join_another_private_channel() {
        let policy = DefaultChannelPolicy;
        let user_meta = connection_meta("u1", vec!["user".to_string()]);
        let channel = ChannelName::parse("user:u2").expect("channel should parse");

        let err = policy
            .can_join(&user_meta, &channel)
            .expect_err("join should be denied");
        assert_eq!(err.message(), "Cannot join another user's private channel");
    }

    #[test]
    fn admin_can_join_another_private_channel() {
        let policy = DefaultChannelPolicy;
        let admin_meta = connection_meta("admin", vec!["admin".to_string(), "user".to_string()]);
        let channel = ChannelName::parse("user:u2").expect("channel should parse");

        policy
            .can_join(&admin_meta, &channel)
            .expect("admin should be allowed");
    }

    #[test]
    fn user_publish_to_admin_channel_is_denied() {
        let policy = DefaultChannelPolicy;
        let user_meta = connection_meta("u1", vec!["user".to_string()]);
        let channel = ChannelName::parse("admin:ops").expect("channel should parse");

        let err = policy
            .can_publish(&user_meta, &channel, "status.updated")
            .expect_err("publish should be denied");
        assert_eq!(err.message(), "Admin channel requires admin role");
    }
}